China 3G router help needed to identify and flash dd-wrt

Post new topic   Reply to topic    DD-WRT Forum Index -> Ralink SoC based Hardware
Goto page 1, 2, 3, 4, 5  Next
Author Message
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Sun Nov 07, 2010 20:15    Post subject: China 3G router help needed to identify and flash dd-wrt Reply with quote
Hi all!

I am a new forum user, but long time dd-wrt user (mostly used on my WRT54GL series). I just bought a cheap 3g router from ebay, which is i think a Ralink 305x based Wireless N router.

Ebay link here: http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=170532549847

The router from the outside looks almost the same as the one on this site, except that mine has its antenna connectors on the right side:
http://www.sztianhao.com/en/ProductShow.asp?ID=272

I have read through this thread, but none of the mentioned firmwares there worked for my router:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=61162

If i telnet to the router it gives the following screen:
--- begin of text ---
Router login: admin
Password:
Welcome to Bococom Router Series
For detailed information, please check:
www.bococom.com


BusyBox v1.12.1 (2010-06-05 03:23:28 CST) built-in shell (msh)
Enter 'help' for a list of built-in commands.
--- end of text ---

I visited the site (www.bococom.com), but there is no product whose picture is even close to the looks of my router.

Also the the router's web gui gives not too many iformation:
--- begin of text ---
System Info
CPU Type: MIPS 4kc 384MHZ
Memory Size: 32MB
Serial Number: 3GR200906296
Software Version: 1.0.3.9
--- end of text ---

The label on the router's bottom states:
WIRELESS-N AP ROUTER
MODEL: TH-R300W

Googling based on these information yielded absolutely no results. I am really tempted to make dd-wrt work on this router, but this is the stage where i need help how i should proceed.

I also made pictures of the inside of the router, i hope it may shed some light on how to proceed with hacking the router. Sorry for the quality of the pictures but i don't have any better camera right now.
Because of the bad quality, i wrote down the text on the memory and flash chip. I could not remove the heatsink from the main CPU it is glued to it very hard.

I uploaded the pictures to imageshack here:
http://img295.imageshack.us/img295/6789/chinarouterantennaside.jpg
http://img209.imageshack.us/img209/8459/chinarouterbottomside.jpg
http://img185.imageshack.us/img185/2446/chinarouterconnectorsid.jpg
http://img408.imageshack.us/img408/6463/chinarouterpcbbottom.jpg
http://img844.imageshack.us/img844/9125/chinarouterpcbtop.jpg
http://img526.imageshack.us/img526/1612/chinaroutertopside.jpg


Memory chips:
Etrontech EM639165TS-6G
O06AG05AGE814.13ZQ

Flash chip:
MX T102144
29LV320DBTI-70G
3D670900

PCB text:
XDX-RN502J V2.0

There is also a 4 pin unsoldered "console" port on the PCB with "J2" marking.

The wireless module's shield is not easily removable, i have not forced the removal of it to look under it.

Radem's post here is a picture which looks almost exactly the same as my router (mine has the USB port already soldered on the PCB):
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=472016#472016

Also mentions later: "good news: this router with last pcb = asus rt-n13u rev A1. Now i have usb support with dd-wrt for rt-n13u"
But no matter how many times i try, i get "Upgrade FAILED, please try again." error if i try to flash the asus-to-ddwrt.trx file through the router's Admin/Firmware-upgrade GUI page.

Any help and suggestions are welcome. Thanks in advance!
Sponsor
Radem
DD-WRT Novice


Joined: 11 Nov 2009
Posts: 10

PostPosted: Sun Nov 07, 2010 23:03    Post subject: Re: China 3G router help needed to identify and flash dd-wrt Reply with quote
peanut_hu wrote:

Radem's post here is a picture which looks almost exactly the same as my router (mine has the USB port already soldered on the PCB):
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=472016#472016

Also mentions later: "good news: this router with last pcb = asus rt-n13u rev A1. Now i have usb support with dd-wrt for rt-n13u"
But no matter how many times i try, i get "Upgrade FAILED, please try again." error if i try to flash the asus-to-ddwrt.trx file through the router's Admin/Firmware-upgrade GUI page.

Any help and suggestions are welcome. Thanks in advance!


They are almost identical to the hardware, but not the software. Wink

Try this:

1) Download Aceex NR22/Y firmware from here: http://www.aceex.com.tw/download_firmware.html ( ftp://autoupgrade.serveftp.com/NR22/root_uImage )

2) Upgrade firmware (just point the downloaded file via web-interface in "upgrade firmware" tab, or so). Wait for several (3-5) minutes and update browser window, you'll see, that web-interface is changed now with Aceex logo and stuff.

3) Reboot your device (turn off/on the power), login via web-interface and assign network settings to reach Internet. Your device should be connected to Internet (any way) to upgrade dd-wrt firmware. After all, connect to your device via telnet ("telnet a.b.c.d", where a.b.c.d is your device ip-address), input username and password and type "dd-wrt.sh" in console. If internet connection is reachable, proper dd-wrt-firmware will be downloaded and installed. You should wait again for several minutes until update procedure will be finished (anyway, 5-10mins, not above) and you will be able to connect your device through 192.168.1.1. That's all.
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Mon Nov 08, 2010 6:47    Post subject: Re: China 3G router help needed to identify and flash dd-wrt Reply with quote
Radem wrote:

They are almost identical to the hardware, but not the software. Wink

Try this:

1) Download Aceex NR22/Y firmware from here: http://www.aceex.com.tw/download_firmware.html ( ftp://autoupgrade.serveftp.com/NR22/root_uImage )

2) Upgrade firmware (just point the downloaded file via web-interface in "upgrade firmware" tab, or so). Wait for several (3-5) minutes and update browser window, you'll see, that web-interface is changed now with Aceex logo and stuff.

3) Reboot your device (turn off/on the power), login via web-interface and assign network settings to reach Internet. Your device should be connected to Internet (any way) to upgrade dd-wrt firmware. After all, connect to your device via telnet ("telnet a.b.c.d", where a.b.c.d is your device ip-address), input username and password and type "dd-wrt.sh" in console. If internet connection is reachable, proper dd-wrt-firmware will be downloaded and installed. You should wait again for several minutes until update procedure will be finished (anyway, 5-10mins, not above) and you will be able to connect your device through 192.168.1.1. That's all.


It's a no go. Already tried the aceex firmware, the aceex-to-ddwrt version, tried the generic firmware on the Skylink china site and tried the wive-rtnl firmware too. Everything tried so far gets simply rejected by the web-if.
radmir
DD-WRT User


Joined: 26 Dec 2008
Posts: 153

PostPosted: Mon Nov 08, 2010 7:18    Post subject: Reply with quote
I've flashed same router via console without any problem.
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Mon Nov 08, 2010 7:55    Post subject: Reply with quote
radmir wrote:
I've flashed same router via console without any problem.


That's a good start, i'm not afraid of a little soldering. Just tell me the pinout of the 4 pin console port so i can make a cable with a RS232 connector myself. I will be more than happy to try updateing through console, i already have a USB<->RS232 serial port cable ready for this. I just need to know which pin of the RS232 connector should go to what pin on the Console connector of the router's PCB. Please point me to a thread if this part is already discussed. Thanks!
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Nov 08, 2010 8:30    Post subject: Reply with quote
peanut_hu wrote:
radmir wrote:
I've flashed same router via console without any problem.


That's a good start, i'm not afraid of a little soldering. Just tell me the pinout of the 4 pin console port so i can make a cable with a RS232 connector myself. I will be more than happy to try updateing through console, i already have a USB<->RS232 serial port cable ready for this. I just need to know which pin of the RS232 connector should go to what pin on the Console connector of the router's PCB. Please point me to a thread if this part is already discussed. Thanks!


USB <-> RS232 cable is no good, RS232 is +-12V levels and the router has 3.3V TTL in the serial port.
You need a level converter from RS232 to TTL 3.3V or even better a mobile phone cable like Nokia DKU-5/CA-42 which already is USB<->TTL 3.3V.

Cut off the phone connector (keep 20mm of cable in the connector so you can measure out which cable is rx, tx, and gnd) and connect the wires directly to the routers serial pads.

_________________
Kernel panic: Aiee, killing interrupt handler!
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Mon Nov 08, 2010 9:23    Post subject: Reply with quote
LOM wrote:
peanut_hu wrote:
radmir wrote:
I've flashed same router via console without any problem.


That's a good start, i'm not afraid of a little soldering. Just tell me the pinout of the 4 pin console port so i can make a cable with a RS232 connector myself. I will be more than happy to try updateing through console, i already have a USB<->RS232 serial port cable ready for this. I just need to know which pin of the RS232 connector should go to what pin on the Console connector of the router's PCB. Please point me to a thread if this part is already discussed. Thanks!


USB <-> RS232 cable is no good, RS232 is +-12V levels and the router has 3.3V TTL in the serial port.
You need a level converter from RS232 to TTL 3.3V or even better a mobile phone cable like Nokia DKU-5/CA-42 which already is USB<->TTL 3.3V.

Cut off the phone connector (keep 20mm of cable in the connector so you can measure out which cable is rx, tx, and gnd) and connect the wires directly to the routers serial pads.


OK, i will get one off of ebay of the mentioned nokia cable type. Is there a way to measure/test which pin is what signal on the console port of the router PCB, because i still don't how i will connect to the router. I don't want to brick it by connecting the pins in the wrong order.

I found this:
http://cgi.ebay.co.uk/DKU-5-USB-Data-Cable-Nokia-7260-6280-3100-6200-/320561495714?pt=UK_MobilePhones_MobilePhoneAccesories_MobilePhoneDataCables_JN&hash=item4aa2f43ea2

Will this do the job ?
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Nov 08, 2010 10:22    Post subject: Reply with quote
peanut_hu wrote:
I just need to know which pin of the RS232 connector should go to what pin on the Console connector of the router's PCB. Please point me to a thread if this part is already discussed. Thanks!


Look at the 4 pads in the console port, one of them is not isolated from the bigger copper ground plane, that is the the ground pin.
Square pad is usually +3.3V which you prolly don't need to connect.
The 2 middle pins should then have tiny copper wires connected to them (look at the bottom side) in which case they are rx and tx.

peanut_hu wrote:


I found this:
http://cgi.ebay.co.uk/DKU-5-USB-Data-Cable-Nokia-7260-6280-3100-6200-/320561495714?pt=UK_MobilePhones_MobilePhoneAccesories_MobilePhoneDataCables_JN&hash=item4aa2f43ea2

Will this do the job ?


Yes it will be perfect and good price it has as well.
With some luck you will get one which only has 3 wires in the cable, ie rx, tx, and gnd.
Gnd is easy to find with an ohm meter - measure between each wire and the metal shield of the USB connector. Some cables does not have the metal shield grounded in which case you have to measure against ground pin in the USB connector (google USB connector pinouts).

Load the driver from the supplied driver disk, connect the USB and check in the computers hardware manager which COM port got created by the driver.

Open a terminal session (puTTY is freeware and very good) set parameters for the new com port to 57600, 8,1,N and no handshake.
Twist the rx and tx wires together and check that keys pressed on the keyboard are displayed on the screen (loopback test).

Now connect gnd rx and tx to the routers console port and start the router.
If you don't get any characters displayed on the screen then power off and swap position of rx and tx wires.

If you get a lot of unreadable text on the screen then the baudrate is wrong, try 115200 in such case.

_________________
Kernel panic: Aiee, killing interrupt handler!
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Mon Nov 08, 2010 16:39    Post subject: Reply with quote
LOM wrote:

Look at the 4 pads in the console port, one of them is not isolated from the bigger copper ground plane, that is the the ground pin.
Square pad is usually +3.3V which you prolly don't need to connect.
The 2 middle pins should then have tiny copper wires connected to them (look at the bottom side) in which case they are rx and tx.

Yes it will be perfect and good price it has as well.
With some luck you will get one which only has 3 wires in the cable, ie rx, tx, and gnd.
Gnd is easy to find with an ohm meter - measure between each wire and the metal shield of the USB connector. Some cables does not have the metal shield grounded in which case you have to measure against ground pin in the USB connector (google USB connector pinouts).

Load the driver from the supplied driver disk, connect the USB and check in the computers hardware manager which COM port got created by the driver.

Open a terminal session (puTTY is freeware and very good) set parameters for the new com port to 57600, 8,1,N and no handshake.
Twist the rx and tx wires together and check that keys pressed on the keyboard are displayed on the screen (loopback test).

Now connect gnd rx and tx to the routers console port and start the router.
If you don't get any characters displayed on the screen then power off and swap position of rx and tx wires.

If you get a lot of unreadable text on the screen then the baudrate is wrong, try 115200 in such case.


I will have to wait approx 2 weeks for the cable to arrive from China with the post. I will definitely report back about the flashing process. Thank you very much for the detailed and fast reply!

- edit - I ordered the cable from U.K. instead, its pricier but should be here by the end of the week.
goodeye
DD-WRT Novice


Joined: 18 Dec 2009
Posts: 36

PostPosted: Sat Nov 13, 2010 8:24    Post subject: Reply with quote
if I'm not mistaken this router is based on Asus RT-N13U. reported in DealExtreme. Does it have detachable antennas. if yes it is Asus RT-N13U...

But try.

_________________
1X Unbranded Ralink SoC RT3052 based router (Dead)
1X Wippies Wifibox
1X TP-Link WR-1043ND
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Sat Nov 13, 2010 9:03    Post subject: Reply with quote
goodeye wrote:
if I'm not mistaken this router is based on Asus RT-N13U. reported in DealExtreme. Does it have detachable antennas. if yes it is Asus RT-N13U...

But try.


It _does_ have detachable antennas, as you can see in the pictures i took. But despite it could be compatible, it cannot be flashed via the web-if so i have to do it via console... still waiting for my cable pff Sad
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Tue Nov 16, 2010 21:10    Post subject: Reply with quote
LOM wrote:
...
With some luck you will get one which only has 3 wires in the cable, ie rx, tx, and gnd.
Gnd is easy to find with an ohm meter - measure between each wire and the metal shield of the USB connector. Some cables does not have the metal shield grounded in which case you have to measure against ground pin in the USB connector (google USB connector pinouts).


Well, i got my cable. I am not the lucky one it seems. This cable has 5 wires in it, a black, blue, orange, green and white one. Anyway i did measure black is GND, on USB connector pin 4. It identifies itself as prolific 2303 usb serial port (very common chip), i set it up as COM2 with 57600bps,8bit,no parity,1 stop bit, no flowcontrol as mentioned.

I also set these parameters in putty when connecting.
I tried every color combination (except the black - GND) but never got the "echo", so i am stuck at the moment what the problem might be. The cable is recognized and detected, the serial port shows up in device manager, i get no error when connecting to the COM2 port with putty, but i don't get any characters in the terminal... any idea ?

According to this topic:
https://forum.openwrt.org/viewtopic.php?pid=41617#p41617
My cable colors are the same however white and blue together doesn't do anything....
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Wed Nov 17, 2010 2:22    Post subject: Reply with quote
peanut_hu wrote:
LOM wrote:
...
With some luck you will get one which only has 3 wires in the cable, ie rx, tx, and gnd.
Gnd is easy to find with an ohm meter - measure between each wire and the metal shield of the USB connector. Some cables does not have the metal shield grounded in which case you have to measure against ground pin in the USB connector (google USB connector pinouts).


Well, i got my cable. I am not the lucky one it seems. This cable has 5 wires in it, a black, blue, orange, green and white one. Anyway i did measure black is GND, on USB connector pin 4. It identifies itself as prolific 2303 usb serial port (very common chip), i set it up as COM2 with 57600bps,8bit,no parity,1 stop bit, no flowcontrol as mentioned.

I also set these parameters in putty when connecting.
I tried every color combination (except the black - GND) but never got the "echo", so i am stuck at the moment what the problem might be. The cable is recognized and detected, the serial port shows up in device manager, i get no error when connecting to the COM2 port with putty, but i don't get any characters in the terminal... any idea ?

According to this topic:
https://forum.openwrt.org/viewtopic.php?pid=41617#p41617
My cable colors are the same however white and blue together doesn't do anything....


White and blue would be my guess also since they are commonly used for rx and tx in various CA-42 versions.
You may have got a CA-42 which needs +3.3V in from the router, I have one of these but my colours does unfortunately not match yours so I can't say which of yours it would be.

It works like this:
The primary (USB) section of the 2203 is powered from the USB cable so the adapter will always be detected when plugged in to a computer.
The secondary (Serial) section is powered from the mobile phone so the serial signals will follow the phones voltage, hence can be used for both 5V and 3.3V TTL.

You won't get any echo back if the serial section is without power.

It is now that you have to measure between the phone connector pins and the wires in the 20mm of cable that you left on the connector.
Schematics of the Nokia DKU-5 (CA-42) phone connector are available on the net (google).
Be aware that pin1 is outside of the plastic tab and the small pins in a row starts with pin 2.

(The remaining wire of the 5 is for signalling to the phone that external accessory (car kit, head phones) is connected so the phone routes the audio to the connector instead of using internal speaker and mic.)

_________________
Kernel panic: Aiee, killing interrupt handler!
peanut_hu
DD-WRT Novice


Joined: 07 Nov 2010
Posts: 17

PostPosted: Wed Nov 17, 2010 17:36    Post subject: Reply with quote
LOM wrote:

White and blue would be my guess also since they are commonly used for rx and tx in various CA-42 versions.
You may have got a CA-42 which needs +3.3V in from the router, I have one of these but my colours does unfortunately not match yours so I can't say which of yours it would be.

It works like this:
The primary (USB) section of the 2203 is powered from the USB cable so the adapter will always be detected when plugged in to a computer.
The secondary (Serial) section is powered from the mobile phone so the serial signals will follow the phones voltage, hence can be used for both 5V and 3.3V TTL.

You won't get any echo back if the serial section is without power.

It is now that you have to measure between the phone connector pins and the wires in the 20mm of cable that you left on the connector.
Schematics of the Nokia DKU-5 (CA-42) phone connector are available on the net (google).
Be aware that pin1 is outside of the plastic tab and the small pins in a row starts with pin 2.

(The remaining wire of the 5 is for signalling to the phone that external accessory (car kit, head phones) is connected so the phone routes the audio to the connector instead of using internal speaker and mic.)


Ok, so i measured the "console" port on the router powered up, i have the common ground (PIN1), the two "inner" pins which do have tiny wiring on the PCB bottomside which you say are RX/TX - PIN2 has no voltage measured against ground PIN1, the PIN3 has 3,32V, and the "square" PIN4 is also 3,32V against ground (PIN1) pin on router.

You say that the cable needs to be powered from the router side too, so i assume i have to connect the PIN4 (square) pin of the router to the serial cable converter, but which pin should i connect it to? Assuming blue and white are the RX/TX pair, and i know that the black is the GND, i have to connect either green or orange to the router's 3,3V?
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Wed Nov 17, 2010 17:59    Post subject: Reply with quote
peanut_hu wrote:


You say that the cable needs to be powered from the router side too, so i assume i have to connect the PIN4 (square) pin of the router to the serial cable converter, but which pin should i connect it to? Assuming blue and white are the RX/TX pair, and i know that the black is the GND, i have to connect either green or orange to the router's 3,3V?


Well, I say that at least one cable that I have needed to be powered from the router since it didn't get power to its serial section from the USB port.
Since you don't get any echo back when directly connecting the 2 wires together that most likely are tx and rx then I believe that you may also have one of those cables that needs to be powered externally.

You don't want to guess which of the cables it is. you should now check with an ohm meter in the phone connector that you cut off.
And yes, it should be connected to the square pad in the router.

_________________
Kernel panic: Aiee, killing interrupt handler!
Goto page 1, 2, 3, 4, 5  Next Display posts from previous:    Page 1 of 5
Post new topic   Reply to topic    DD-WRT Forum Index -> Ralink SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum